OIDC registration doesn't work; creates shadow account but errors out #2082

New issue

Closed

opened 2026-07-31 21:48:10 +00:00 by alejand · 0 comments

alejand commented

2026-07-31 21:48:10 +00:00

This does result in the creation of a shadow account; I realised this when trying again with the same username, and instead of getting the same error, I arrived at the password prompt for a legacy account.

I then tried to change the password with an admin room command, getting this message:
The provided user is a shadow or deactivated account. To convert it to a local account, pass the --convert-to-local-account flag.
I imagine using that flag could be a workaround for registering accounts.

My c10y config:

[global]
server_name = "alejand.org"
database_path = "/var/lib/continuwuity"
port = 6167
max_request_size = 20000000000 # in bytes, ~20 GB

dns_cache_entries = 0
query_over_tcp_only = true
dns_attempts = 10
dns_timeouts = 10

[global.oauth.oidc]
discovery_url = "https://auth.alejand.org"
client_id = "c10y"
client_secret = "secret"
compatibility_mode = "hybrid"

[global.well_known]
client = "https://matrix.alejand.org"
server = "matrix.alejand.org:443"

CONTINUWUITY_ALLOW_REGISTRATION: 'true'
CONTINUWUITY_REGISTRATION_TOKEN: 'redacted' # A registration token is required when registration is allowed.
CONTINUWUITY_ALLOW_FEDERATION: 'true'
CONTINUWUITY_ALLOW_CHECK_FOR_UPDATES: 'true'
CONTINUWUITY_ALLOW_OUTGOING_PRESENCE: 'true'

Hello, facing an issue when using Authelia as OIDC provider with c10y. Linking an Authelia account with an existing matrix account works fine. When trying to create a new matrix account, I get "Internal server error: Request handler panicked! Failure to reference service required by another service.: Service "membership" does not exist or has not been built yet." This does result in the creation of a shadow account; I realised this when trying again with the same username, and instead of getting the same error, I arrived at the password prompt for a legacy account. I then tried to change the password with an admin room command, getting this message: `The provided user is a shadow or deactivated account. To convert it to a local account, pass the --convert-to-local-account flag.` I imagine using that flag could be a workaround for registering accounts. My c10y config: ``` [global] server_name = "alejand.org" database_path = "/var/lib/continuwuity" port = 6167 max_request_size = 20000000000 # in bytes, ~20 GB dns_cache_entries = 0 query_over_tcp_only = true dns_attempts = 10 dns_timeouts = 10 [global.oauth.oidc] discovery_url = "https://auth.alejand.org" client_id = "c10y" client_secret = "secret" compatibility_mode = "hybrid" [global.well_known] client = "https://matrix.alejand.org" server = "matrix.alejand.org:443" ``` ``` CONTINUWUITY_ALLOW_REGISTRATION: 'true' CONTINUWUITY_REGISTRATION_TOKEN: 'redacted' # A registration token is required when registration is allowed. CONTINUWUITY_ALLOW_FEDERATION: 'true' CONTINUWUITY_ALLOW_CHECK_FOR_UPDATES: 'true' CONTINUWUITY_ALLOW_OUTGOING_PRESENCE: 'true' ```